4 ms·
> I’ve been backing up to AWS, which is always a pain because it’s annoying to navigate the AWS console to generate credentials. I got so annoyed with that a f
by simonw 3mo ago
> I’ve been backing up to AWS, which is always a pain because it’s annoying to navigate the AWS console to generate credentials.
I got so annoyed with that a few years ago that I ended up building a whole tool just to solve that one problem:
uvx s3-credentials create my-existing-s3-bucket
This spits out read-write credentials that are scoped JUST for that bucket. You can add --read-only or --write-only to have credentials that are further locked down, or even add --prefix foo/bar for credentials that can only read/write keys that start with that prefix within the bucket.
> Maybe one day I’ll move away to some other S3-compatible alternative.
I've used Restic with Cloudflare R2 and it worked great.
- swyx 3mo agothis is pretty brilliant, aws cli should sherlock this. when would you want write only?
- simonw 3mo agoFor logging, in particular for an environment where you don't want a leaked credential to allow the deletion of any previously recorded files.
- Natfan 3mo agodoes write only prevent overwrites?
- simonw 3mo agoGood point, no it doesn't.
- Natfan 3mo agobut i suppose if you're prefixing your entries with enough entropy, it'd be quite difficult for adversaries to predict and overwrite files without an `ls` equivalent
- ufmace 3mo agoIt does effectively, if you turn on bucket versioning. I think write-only is worthwhile for database backups to guard against a ransomware compromise.
- hiAndrewQuinn 3mo agoPrior art also has https://litestream.io/ https://litestream.io/
- bspammer 3mo agoA more general solution for dealing with complex AWS services is learning just enough terraform to let LLMs do the rest. It also makes it much easier to tear stuff down later as you won’t need to remember what you created.
- noctune 3mo agoOr cloudformation, if it is just for AWS anyhow.